EUVD-2026-40430
GHSA-644f-gvrf-jgw7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network endpoint with low complexity but requires an authenticated user holding app.create_channel (PR:L); impact is primarily integrity (channel overwrite/ownership takeover) with minor confidentiality and availability effects.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.2 contains an authorization bypass vulnerability in the channel creation endpoint that allows authenticated users to overwrite existing channels by reusing their names. Attackers with app.create_channel permission can exploit a logic mismatch between existence validation and upsert operations to reassign channel ownership and modify critical production channel configurations.
AnalysisAI
Privilege-bound authorization bypass in Capgo before 12.128.2 lets any authenticated user holding the app.create_channel permission overwrite existing channels by reusing their names, hijacking ownership and rewriting production channel configurations. The flaw stems from a logic mismatch between the existence-validation check and the upsert operation in the channel-creation endpoint, enabling tampering with live release channels. No public exploit identified at time of analysis; reported by VulnCheck with a vendor security advisory available.
Technical ContextAI
Capgo is a live/over-the-air update platform for Capacitor mobile apps, where 'channels' are named distribution buckets that map app builds to user cohorts (e.g. production, beta). The vulnerability is rooted in CWE-285 (Improper Authorization): the POST channel-creation handler validates whether a channel name already exists, but the underlying database write is an upsert (insert-or-update) rather than an insert-only operation. Because the authorization/existence logic does not match the persistence behavior, supplying an already-taken channel name causes the existing record to be reassigned and overwritten instead of being rejected, transferring ownership to the requesting user. The affected component is cpe:2.3:a:capgo:capgo across all versions prior to the fix.
RemediationAI
Upgrade Capgo to version 12.128.2 or later, which corrects the logic mismatch between existence validation and the upsert operation in the channel-creation endpoint (Vendor-released patch: 12.128.2; see GHSA-vj24-j594-3wv3). Until the upgrade is applied, restrict who holds the app.create_channel permission to trusted operators only, since that permission is the gating prerequisite - this reduces the attacker population but may slow legitimate channel management workflows. As additional compensating controls, audit existing channels for unexpected ownership changes or configuration modifications, and monitor channel-creation requests for names that collide with existing production channels, accepting that such monitoring is detective rather than preventive. Consult the VulnCheck advisory (https://www.vulncheck.com/advisories/capgo-unauthorized-channel-overwrite-and-ownership-takeover-via-post-channel-name-collision) for confirmation details.
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today